In WCF, server hasn't accessed client's public key and client hasn't accessed server's public key - still the web-method operation is successful. Why?

Question

I have a WCF service on a dev server secured with X.509 server certificate (.pfx) [not self-signed, organization provided] using message security.

On my loc